Wireshark · Ethereal-users: Re: [Ethereal-users] JPG-Export from captured file (TCP-Reassembly)

["Olivier Biot" <ethereal@xxxxxxxxxx>]

Harry,

Go to Edit -> Preferences. In the left pane, click on "Protocols" so you can 
edit the protocol preferences.

Look at TCP, and make sure that "Allow subdissector to reassemble TCP 
streams" is enabled.
Then look at HTTP, and enable at least the first 3 preferences (reassemble 
headers, reassemble bodies, reassemble chunked bodies).

Save the preferences, and reload the capture file (you may use the display 
filter "image-jfif or image-gif" to search for JPEG and GIF in the captured 
packets).

Once you found an image, click on the protocol line in the dissection window 
("JPEG File Interchange Format" or "Compuserve GIF, Version: 87a/89a") so 
the relevant bytes get highlighted (selected), and export the selected 
packet bytes, either from the File menu, or by right-clicking on the packet.

Best regards,

Olivier

----- Original Message ----- 
From: ThEbIg

> Hi,
> i've read the tutorial about TCP-Reassembly on wiki.ethereal.com
>
> My ethereal is configured as shown in the tutorial, but if i receive a jpg
> file, which is bigger than one packet, the first packet is a http-packet
> with content-type: image/jpeg, the next packets are HTTP-continuations.
> So its not possible to save a valid jpg-file! :(((
>
> I use Ethereal 0.10.3 (SUSE-Linux), could this be the problem?
>
> Thanks for answering
>
> Harry